c476756cd6
The snakeoil package uses the host's fqdn for the cert's CN, which means trying to use '127.0.0.1' as the JJB URL will fail with an SSL error, and the curl tests will also fail. JJB also doesn't have --insecure or --cafle options, so it gets a SSL_CERTIFICATE_VERIFY_FAILED when trying to run. Use the fqdn everywhere instead of the localhost address, and add the snakeoil certs to the system's trusted bundle. Change-Id: Iac97910b0d04eada62dd161341ee246a9cf3ebf8
47 lines
1.1 KiB
Puppet
47 lines
1.1 KiB
Puppet
exec { 'update apt':
|
|
command => '/usr/bin/apt-get update',
|
|
}
|
|
|
|
# Installing ssl-cert in order to get snakeoil certs
|
|
package { 'ssl-cert':
|
|
ensure => present,
|
|
require => Exec['update apt'],
|
|
}
|
|
|
|
vcsrepo { '/etc/project-config':
|
|
ensure => latest,
|
|
provider => git,
|
|
revision => 'master',
|
|
source => 'git://git.openstack.org/openstack-infra/project-config',
|
|
}
|
|
|
|
# Generates ssh rsa keys
|
|
define ssh_keygen (
|
|
$ssh_directory = undef
|
|
) {
|
|
Exec { path => '/bin:/usr/bin' }
|
|
|
|
$ssh_key_file = "${ssh_directory}/${name}"
|
|
|
|
exec { "ssh-keygen for ${name}":
|
|
command => "ssh-keygen -t rsa -f ${ssh_key_file} -N ''",
|
|
creates => $ssh_key_file,
|
|
}
|
|
}
|
|
|
|
$ssh_key_directory = '/tmp/jenkins-ssh-keys'
|
|
file { $ssh_key_directory:
|
|
ensure => directory,
|
|
}
|
|
ssh_keygen { 'ssh_rsa_key':
|
|
ssh_directory => $ssh_key_directory,
|
|
require => File[$ssh_key_directory],
|
|
}
|
|
|
|
# JJB doesn't have a --insecure or --capath, so add the snakeoil certs to the system trust store
|
|
exec { 'trust snake oil':
|
|
command => '/bin/cp /etc/ssl/certs/ssl-cert-snakeoil.pem /usr/local/share/ca-certificates/ubuntu.crt && /usr/sbin/update-ca-certificates',
|
|
require => Package['ssl-cert'],
|
|
}
|
|
|